Denial of Service Attacks- From Bandwidth to APIs

Edward G.Amoroso,

In the months leading up to the Millennium change, the Clinton White House was developing a comprehensive fusion center in Washington, DC to monitor the Y2K transition status of IT systems around the world. The idea was that domestic and international groups would willingly provide real-time information about their computers and software to the Y2K center via e-mail or the Web. This information would then be fused and reported to the President and the American people. Podiums with official logos were set up in front of the center floor so that news channels could cover these status briefings on television.  

An interesting security challenge soon emerged,  when someone noticed that a so-called zombie net–today, you would refer to this as a botnet–might be used to clog up the communication networks supporting the center’s e-mail and Web servers. Cyber Security experts were brought in to examine this denial-of-service risk, and a number of security risk mitigations were examined (and eventually tossed). 

Sadly, the most practical solution to be adopted involved nothing more than having system administrators stand ready to reboot servers if an attack ensued–and luckily none did. Experts felt lucky to have avoided catastrophe, and the security community immediately began to conceptualize solutions using Internet management protocols such as the Border Gateway Protocol (BGP). However three months after Y2K, several major e-Commerce sites including eBay saw the world’s first truly consequential denial- of- service attack, and the rest is cyber security history.  

“The reason virtualization, cloud automation, and SDNs are so relevant to cyber security is that APIs have now become the new communications channels for cloud replacing traditional IP networks”

Today, we have a new security challenge–and it is called cloud. For the past few years, experts have been debating on the best ways to manage risk in virtualized data centers and Internet-facing public clouds. Luckily, a broad consensus is emerging through strong authentication, proper end-to-end encryption, and comprehensive activity monitoring; private data can be highly protected virtually in the cloud–perhaps even exceeding the security levels of enterprise perimeters. 

Interestingly, the cloud security debate has not focused much on denial-of -service attacks because of the protection progress that has been made since Y2K. Cyber Security and service providers, for example, can now help to detect, divert, and filter botnet attacks aimed at any Internet-connected entity, and this includes public cloud portals. Content Distribution Networks (CDNs) provide additional network security by scattering inbound target points. So when the issue of cloud denial -of -service is raised, most experts shrug. 

The problem is that cloud technology involves so much more than a fanciful portal into a public utility cloud offering cheap storage to users. The essence of cloud technology is automation through virtual interfaces called Application Programming Interfaces or APIs. Such virtual interfaces allow dynamic service chaining, which is the magic by which cloud systems become extensible to users and third-parties on-demand. When service providers virtualize capability through APIs in this manner, the result is something called a Software Defined Network (SDN). 

The reason virtualization, cloud automation, and SDNs are so relevant to cyber security is that APIs have now become the new communications channels for cloud  replacing traditional IP networks. A given cloud workload, for example, will now communicate with another cloud workload across